Feature Maturity¶
This page records the maturity of each component as of the current commit. It is the single source of truth for what is validated, what is scaffolded, and what is planned. The README carries a condensed summary that links here.
Tiers¶
- Supported: deploys through the standard flow, is documented, and has been exercised end to end (thesis result, automated test, or manual validation). Reproducible on a clean install. Enabled by default.
- Experimental: code and manifests exist and deploy, but the path is not
validated end to end, or it depends on an experimental component, or it has no
exercised use case. Often disabled by default (
replicas: 0or opt-in). - Planned: described as a direction, with no working code yet.
Tier assignment rule: a component is Supported only when all three conditions hold (deploys through the standard flow, is documented, exercised end to end). If one condition fails it is Experimental. With no working code it is Planned. Abandoned code is removed, not tiered.
A tier followed by * is an explicit exception: the component is shown at its
target tier while end-to-end validation is still in progress. The remaining work
is tracked in gaps.md, and the marker is removed once the component is
validated end to end.
The Validated by column records the evidence: a thesis reference, a test
path, manual, or —.
Components¶
| Component | Tier | Validated by | Default | Notes |
|---|---|---|---|---|
| Core deployment (K3s master + worker, Open5GS SBA NFs, MongoDB) | Supported | manual | on | 12 pods; AMF, SMF, UPF, NRF, PCF, AUSF, BSF, NSSF, UDM, UDR |
| Per-interface VXLAN overlays (N1-N4) on OVS | Supported | manual | on | one VNI per interface |
| Multus NADs: a Whereabouts pool NAD and a static NAD per plane | Supported | manual + make ran |
on | one address per interface; fixed endpoints on the static NAD, see architecture/5g-interfaces.md |
NetworkPolicies on the pod network (phase 13; mec also limited outbound) |
Supported | manual (probe pod + NodePort checks) + make e2e/ran/camara/iam |
on | flows measured with conntrack first; applied one namespace at a time, see architecture/namespaces.md#network-policies |
| Plane isolation filter on the worker (nftables, crossing counters in Prometheus) | Supported | manual + make ran |
on | observed under physical RAN and UE traffic, then enforced; not-allowed traffic counted per pair of planes with per-rule log samples; drop verified with a probe crossing N3 to N4, see architecture/plane-isolation.md |
| MEC data network routed through the UPF (no NAT on N6m) | Supported | manual + make e2e |
on | apps see the UE address and answer on N6m; verified with a physical UE stream to an N6m app, see architecture/5g-interfaces.md#data-networks |
| IAM / Keycloak realm (phase 08) | Supported | manual | on | admin and viewer roles, orthogonal CAMARA role |
| Dashboard modules: cluster, 5G, network, and settings surfaces (listed in dashboard/modules.md) | Supported | manual | on | image hot-updatable on a running testbed; UE session data from a native Open5GS endpoint |
| Dashboard module: Isolation (plane matrix, blocked samples, namespace policies, flow check) | Experimental | backend unit tests + manual API checks | on | the API is verified live against the cluster; the page is not yet visually reviewed and ships with the next frontend release |
Dashboard header: breadcrumb, status pill (/api/v1/status/summary), updates, environment, clock, account menu |
Experimental | backend unit tests + manual API checks | on | the summary endpoint is verified live; the header is not yet visually reviewed and ships with the next frontend release |
| Dashboard API default-deny (a route without a role stops the backend) | Supported | backend unit tests + manual | on | three public routes, admin token generated by the CLI, see security/iam.md#default-deny |
| Dashboard module: Northbound (positioning/CAMARA service console) | Experimental | — | on | inventory + adapter registry + deploy-from-image + fusion + contract guidance; deploy-from-image gated by allow_workload_create; needs e2e against the live stack |
| Dashboard module: Storage (node disk breakdown + reclaim actions) | Experimental | manual | on | breakdown (containerd layers vs blobs, per-claim volumes, registry, journald) and the estimated saving per action verified live against the worker; the reclaim actions themselves (image prune, journal vacuum, real registry GC) have only been exercised as dry runs |
testbed update (pull new commits, list phases to re-run) |
Experimental | manual | on | fast-forward pull, dirty-tree refusal, and the changed-path to phase mapping verified locally; not yet exercised on a checkout that was actually behind |
| Node and NF metrics (Prometheus to Metrics module and Overview) | Supported | manual | on | |
| Physical RAN attach (femtocell) | Supported | manual | on | validated as a working private 5G network, end to end |
Physical RAN attach/detach as pieces (ran_attach, ran_detach, dashboard RAN page and kelt run-piece) |
Experimental | runner + backend unit tests, check-mode runs | on | plays, lock group, typed confirmation and the read-backs are tested; the attached state reads back live; a real detach and attach through the pieces has not been run yet |
| CAMARA Location + positioning demo (phase 10 northbound) | Supported * | manual: retrieve e2e + make iam | off | thesis core; opt-in via testbed northbound on; CAMARA retrieve returns a location end to end (client_credentials token to gateway to engine to mock, HTTP 200), make iam green; interactive demo/editor browser login still being exercised |
Standalone synthetic-adapter (phase 10, positioning_engine) |
Supported * | manual | off | Tier-1 synthetic source in the lean baseline; the engine discovers it via its devices capability and it exercises the real /measurement HTTP contract end to end |
placement-editor geometry UI (phase 10, placement_editor) |
Experimental | blueprint round trip on 0.19.1, 2026-10-08: editor login, PUT /blueprint, engine, GET /blueprint through the gateway |
off | write-client to the engine blueprint store (PUT /blueprint, no PVC); always fronted by the generic frontdoor_gate (oauth2-proxy, NodePort 31950, Keycloak g-positioning-editors/g-dashboard-admins); gate verified live (302 to canonical login, dual-URL) |
frontdoor_gate reusable Keycloak gate (phase 10) |
Experimental | manual | off | generic oauth2-proxy role (dual-URL: browser canonical issuer, server-side in-cluster); gates any no-auth surface; placement-editor is the first consumer; redirect-to-login proven, interactive e2e pending |
Custom adapter catalog (wifi-adapter, vendor-adapter, bring-your-own image) |
Experimental | — | off | deployed on demand from the Northbound dashboard console, not by Ansible |
| 3GPP network-based positioning (LMF) | Planned | — | — | out of scope on current hardware; position is sourced from non-3GPP adapters instead. See known-issues/no-network-based-positioning.md |
| Guided contract-driven service setup (dashboard) | Experimental | manual | off | reads each service's /contract (0.3.0+) and walks required/recommended/optional fields; apply routes by sensitive to Secret vs ConfigMap (single mechanism), then rolls; first version, UX iterating |
| Single-origin front-door (phase 11) | Experimental | manual: --syntax-check + check-mode render | base-domain-conditional | in-cluster nginx routes <subdomain>.<base> by Host behind one Cloudflare wildcard; deploys only when external_base_domain is set; templates render clean, end-to-end routing through the wildcard not yet exercised on a live tunnel |
| Edge apps platform (phase 12: local registry + deploy-from-image + dynamic route) | Experimental | — | off | opt-in via testbed apps on; in-cluster registry:2 (insecure HTTP + basic-auth, NodePort only) + registry namespace + dashboard Apps page (deploy/list/delete, allow_workload_create gated); front-door routes <name>.<base> dynamically; not yet exercised e2e. See architecture/edge-apps.md |
| Idempotent re-provision and frontend image update (CLI/TUI) | Supported | manual | on | non-breaking upgrade of existing deployments is a v1 goal |
| Diagnostics / log management | Experimental | — | on | present, not extensively validated |
| Grafana advanced and alert rules (phase 07) | Experimental | — | opt-in | metrics pipeline works; alerting and log dashboards unvalidated |
| UERANSIM simulated RAN (phase 06) | Experimental | — | off | not currently exercised; see Reproducibility scope |
| KubeEdge edge node (phase 03) | Experimental | — | off | semi-implemented, no exercised use case |
| UPF-MEC | Experimental | — | replicas: 0 |
CNI route conflict, see known-issues/upf-edge-cni-route-conflict.md |
| Edge worker provisioning from dashboard | Planned | — | — | not built |
| MEC service scheduling (dashboard) | Planned | — | — | depends on the edge path |
| O-RAN near-RT RIC, NWDAF, NF update detection | Planned | — | — | directions, no code |
Companion repositories¶
The testbed consumes images produced by two separate repositories, bound by
image tags in ansible/group_vars/all.yml.
| Repository | Role | Status | Binding |
|---|---|---|---|
nf-platform |
Builds and patches Open5GS NF images, CI/CD, versioning | Image build pipeline in use; per-NF independent updates planned | image tags consumed via all.yml |
5g-northbound |
CAMARA and positioning application images | In active development | image tags pulled by phases 10-12 |
Reproducibility scope¶
The reproducible artifact is the software platform: the 5G core, SDN/NFV orchestration, overlay networking, IAM, dashboard, and the optional northbound addons all deploy in software on a single workstation from a clean install, with no RAN hardware required.
The RAN attaches at a clean boundary, in two modes:
- Physical femtocell: plug and play. A femtocell connected to the worker yields a working private 5G network end to end. This is the validated path today.
- UERANSIM (software RAN): a hardware-free end-to-end data plane. In progress, a v1 objective.
Hardware is needed only for an over-the-air data plane, not to deploy or operate the platform. See deployment/phases.md for the core vs optional phase split.